Security professionals conducting investigations are charged with gathering credible evidence to determine if, when, where, why and how an incident occurred.
https://www.securitymagazine.com/articles/100310-the-3-cs-of-a-successful-security-investigation